########################################
# MSF constants
########################################

HEADER_SIZE = 8
AES_IV_SIZE = 16
START_OFFSET = 24

#
# TLV Meta Types
#
TLV_META_TYPE_NONE = 0
TLV_META_TYPE_STRING = (1 << 16)
TLV_META_TYPE_UINT = (1 << 17)
TLV_META_TYPE_RAW = (1 << 18)
TLV_META_TYPE_BOOL = (1 << 19)
TLV_META_TYPE_QWORD = (1 << 20)
TLV_META_TYPE_COMPRESSED = (1 << 29)
TLV_META_TYPE_GROUP = (1 << 30)
TLV_META_TYPE_COMPLEX = (1 << 31)

################################################
# COMMAND_ID - CORE
################################################

# Effectively maps to the number of commands an extension can
# have. Each extension ID starts at a range boundary and is used
# to identify extensions.
COMMAND_ID_RANGE = 1000

# ID for the extension (needs to be a multiple of 1000)
EXTENSION_ID_CORE = 0

COMMAND_ID_CORE_CHANNEL_CLOSE = EXTENSION_ID_CORE + 1
COMMAND_ID_CORE_CHANNEL_EOF = EXTENSION_ID_CORE + 2
COMMAND_ID_CORE_CHANNEL_INTERACT = EXTENSION_ID_CORE + 3
COMMAND_ID_CORE_CHANNEL_OPEN = EXTENSION_ID_CORE + 4
COMMAND_ID_CORE_CHANNEL_READ = EXTENSION_ID_CORE + 5
COMMAND_ID_CORE_CHANNEL_SEEK = EXTENSION_ID_CORE + 6
COMMAND_ID_CORE_CHANNEL_TELL = EXTENSION_ID_CORE + 7
COMMAND_ID_CORE_CHANNEL_WRITE = EXTENSION_ID_CORE + 8
COMMAND_ID_CORE_CONSOLE_WRITE = EXTENSION_ID_CORE + 9
COMMAND_ID_CORE_ENUMEXTCMD = EXTENSION_ID_CORE + 10
COMMAND_ID_CORE_GET_SESSION_GUID = EXTENSION_ID_CORE + 11
COMMAND_ID_CORE_LOADLIB = EXTENSION_ID_CORE + 12
COMMAND_ID_CORE_MACHINE_ID = EXTENSION_ID_CORE + 13
COMMAND_ID_CORE_MIGRATE = EXTENSION_ID_CORE + 14
COMMAND_ID_CORE_NATIVE_ARCH = EXTENSION_ID_CORE + 15
COMMAND_ID_CORE_NEGOTIATE_TLV_ENCRYPTION = EXTENSION_ID_CORE + 16
COMMAND_ID_CORE_PATCH_URL = EXTENSION_ID_CORE + 17
COMMAND_ID_CORE_PIVOT_ADD = EXTENSION_ID_CORE + 18
COMMAND_ID_CORE_PIVOT_REMOVE = EXTENSION_ID_CORE + 19
COMMAND_ID_CORE_PIVOT_SESSION_DIED = EXTENSION_ID_CORE + 20
COMMAND_ID_CORE_SET_SESSION_GUID = EXTENSION_ID_CORE + 21
COMMAND_ID_CORE_SET_UUID = EXTENSION_ID_CORE + 22
COMMAND_ID_CORE_SHUTDOWN = EXTENSION_ID_CORE + 23
COMMAND_ID_CORE_TRANSPORT_ADD = EXTENSION_ID_CORE + 24
COMMAND_ID_CORE_TRANSPORT_CHANGE = EXTENSION_ID_CORE + 25
COMMAND_ID_CORE_TRANSPORT_GETCERTHASH = EXTENSION_ID_CORE + 26
COMMAND_ID_CORE_TRANSPORT_LIST = EXTENSION_ID_CORE + 27
COMMAND_ID_CORE_TRANSPORT_NEXT = EXTENSION_ID_CORE + 28
COMMAND_ID_CORE_TRANSPORT_PREV = EXTENSION_ID_CORE + 29
COMMAND_ID_CORE_TRANSPORT_REMOVE = EXTENSION_ID_CORE + 30
COMMAND_ID_CORE_TRANSPORT_SETCERTHASH = EXTENSION_ID_CORE + 31
COMMAND_ID_CORE_TRANSPORT_SET_TIMEOUTS = EXTENSION_ID_CORE + 32
COMMAND_ID_CORE_TRANSPORT_SLEEP = EXTENSION_ID_CORE + 33
COMMAND_ID_CORE_PIVOT_SESSION_NEW = EXTENSION_ID_CORE + 34

################################################
# COMMAND_ID - ANDROID
################################################

# ID for the extension (needs to be a multiple of 1000)
EXTENSION_ID_ANDROID = 5000

# Associated command ids
COMMAND_ID_ANDROID_ACTIVITY_START = EXTENSION_ID_ANDROID + 1
COMMAND_ID_ANDROID_CHECK_ROOT = EXTENSION_ID_ANDROID + 2
COMMAND_ID_ANDROID_DEVICE_SHUTDOWN = EXTENSION_ID_ANDROID + 3
COMMAND_ID_ANDROID_DUMP_CALLLOG = EXTENSION_ID_ANDROID + 4
COMMAND_ID_ANDROID_DUMP_CONTACTS = EXTENSION_ID_ANDROID + 5
COMMAND_ID_ANDROID_DUMP_SMS = EXTENSION_ID_ANDROID + 6
COMMAND_ID_ANDROID_GEOLOCATE = EXTENSION_ID_ANDROID + 7
COMMAND_ID_ANDROID_HIDE_APP_ICON = EXTENSION_ID_ANDROID + 8
COMMAND_ID_ANDROID_INTERVAL_COLLECT = EXTENSION_ID_ANDROID + 9
COMMAND_ID_ANDROID_SEND_SMS = EXTENSION_ID_ANDROID + 10
COMMAND_ID_ANDROID_SET_AUDIO_MODE = EXTENSION_ID_ANDROID + 11
COMMAND_ID_ANDROID_SET_WALLPAPER = EXTENSION_ID_ANDROID + 12
COMMAND_ID_ANDROID_SQLITE_QUERY = EXTENSION_ID_ANDROID + 13
COMMAND_ID_ANDROID_WAKELOCK = EXTENSION_ID_ANDROID + 14
COMMAND_ID_ANDROID_WLAN_GEOLOCATE = EXTENSION_ID_ANDROID + 15

################################################
# COMMAND_ID - APPAPI
################################################

# ID for the extension (needs to be a multiple of 1000)
EXTENSION_ID_APPAPI = 9000

# Associated command ids
COMMAND_ID_APPAPI_APP_INSTALL = EXTENSION_ID_APPAPI + 1
COMMAND_ID_APPAPI_APP_LIST = EXTENSION_ID_APPAPI + 2
COMMAND_ID_APPAPI_APP_RUN = EXTENSION_ID_APPAPI + 3
COMMAND_ID_APPAPI_APP_UNINSTALL = EXTENSION_ID_APPAPI + 4

################################################
# COMMAND_ID - ESPIA
################################################

# ID for the extension (needs to be a multiple of 1000)
EXTENSION_ID_ESPIA = 11000

# Associated command ids
COMMAND_ID_ESPIA_IMAGE_GET_DEV_SCREEN = EXTENSION_ID_ESPIA + 1

################################################
# COMMAND_ID - EXTAPI
################################################

# ID for the extension (needs to be a multiple of 1000)
EXTENSION_ID_EXTAPI = 3000

# Associated command ids
COMMAND_ID_EXTAPI_ADSI_DOMAIN_QUERY = EXTENSION_ID_EXTAPI + 1
COMMAND_ID_EXTAPI_CLIPBOARD_GET_DATA = EXTENSION_ID_EXTAPI + 2
COMMAND_ID_EXTAPI_CLIPBOARD_MONITOR_DUMP = EXTENSION_ID_EXTAPI + 3
COMMAND_ID_EXTAPI_CLIPBOARD_MONITOR_PAUSE = EXTENSION_ID_EXTAPI + 4
COMMAND_ID_EXTAPI_CLIPBOARD_MONITOR_PURGE = EXTENSION_ID_EXTAPI + 5
COMMAND_ID_EXTAPI_CLIPBOARD_MONITOR_RESUME = EXTENSION_ID_EXTAPI + 6
COMMAND_ID_EXTAPI_CLIPBOARD_MONITOR_START = EXTENSION_ID_EXTAPI + 7
COMMAND_ID_EXTAPI_CLIPBOARD_MONITOR_STOP = EXTENSION_ID_EXTAPI + 8
COMMAND_ID_EXTAPI_CLIPBOARD_SET_DATA = EXTENSION_ID_EXTAPI + 9
COMMAND_ID_EXTAPI_NTDS_PARSE = EXTENSION_ID_EXTAPI + 10
COMMAND_ID_EXTAPI_PAGEANT_SEND_QUERY = EXTENSION_ID_EXTAPI + 11
COMMAND_ID_EXTAPI_SERVICE_CONTROL = EXTENSION_ID_EXTAPI + 12
COMMAND_ID_EXTAPI_SERVICE_ENUM = EXTENSION_ID_EXTAPI + 13
COMMAND_ID_EXTAPI_SERVICE_QUERY = EXTENSION_ID_EXTAPI + 14
COMMAND_ID_EXTAPI_WINDOW_ENUM = EXTENSION_ID_EXTAPI + 15
COMMAND_ID_EXTAPI_WMI_QUERY = EXTENSION_ID_EXTAPI + 16

################################################
# COMMAND_ID - INCOGNITO
################################################

# ID for the extension (needs to be a multiple of 1000)
EXTENSION_ID_INCOGNITO = 12000

# Associated command ids
COMMAND_ID_INCOGNITO_ADD_GROUP_USER = EXTENSION_ID_INCOGNITO + 1
COMMAND_ID_INCOGNITO_ADD_LOCALGROUP_USER = EXTENSION_ID_INCOGNITO + 2
COMMAND_ID_INCOGNITO_ADD_USER = EXTENSION_ID_INCOGNITO + 3
COMMAND_ID_INCOGNITO_IMPERSONATE_TOKEN = EXTENSION_ID_INCOGNITO + 4
COMMAND_ID_INCOGNITO_LIST_TOKENS = EXTENSION_ID_INCOGNITO + 5
COMMAND_ID_INCOGNITO_SNARF_HASHES = EXTENSION_ID_INCOGNITO + 6

################################################
# COMMAND_ID - KIWI
################################################

# ID for the extension (needs to be a multiple of 1000)
EXTENSION_ID_KIWI = 8000

# Associated command ids
COMMAND_ID_KIWI_EXEC_CMD = EXTENSION_ID_KIWI + 1

################################################
# COMMAND_ID - LANATTACKS
################################################

# ID for the extension (needs to be a multiple of 1000)
EXTENSION_ID_LANATTACKS = 15000

# Associated command ids
COMMAND_ID_LANATTACKS_ADD_TFTP_FILE = EXTENSION_ID_LANATTACKS + 1
COMMAND_ID_LANATTACKS_DHCP_LOG = EXTENSION_ID_LANATTACKS + 2
COMMAND_ID_LANATTACKS_RESET_DHCP = EXTENSION_ID_LANATTACKS + 3
COMMAND_ID_LANATTACKS_RESET_TFTP = EXTENSION_ID_LANATTACKS + 4
COMMAND_ID_LANATTACKS_SET_DHCP_OPTION = EXTENSION_ID_LANATTACKS + 5
COMMAND_ID_LANATTACKS_START_DHCP = EXTENSION_ID_LANATTACKS + 6
COMMAND_ID_LANATTACKS_START_TFTP = EXTENSION_ID_LANATTACKS + 7
COMMAND_ID_LANATTACKS_STOP_DHCP = EXTENSION_ID_LANATTACKS + 8
COMMAND_ID_LANATTACKS_STOP_TFTP = EXTENSION_ID_LANATTACKS + 9

################################################
# COMMAND_ID - MIMIKATZ
################################################

# ID for the extension (needs to be a multiple of 1000)
EXTENSION_ID_MIMIKATZ = 17000

# Associated command ids
COMMAND_ID_MIMIKATZ_CUSTOM_COMMAND = EXTENSION_ID_MIMIKATZ + 1

################################################
# COMMAND_ID - PEINJECTOR
################################################

# ID for the extension (needs to be a multiple of 1000)
EXTENSION_ID_PEINJECTOR = 16000

# Associated command ids
COMMAND_ID_PEINJECTOR_INJECT_SHELLCODE = EXTENSION_ID_PEINJECTOR + 1

################################################
# COMMAND_ID - POWERSHELL
################################################

# ID for the extension (needs to be a multiple of 1000)
EXTENSION_ID_POWERSHELL = 14000

# Associated command ids
COMMAND_ID_POWERSHELL_ASSEMBLY_LOAD = EXTENSION_ID_POWERSHELL + 1
COMMAND_ID_POWERSHELL_EXECUTE = EXTENSION_ID_POWERSHELL + 2
COMMAND_ID_POWERSHELL_SESSION_REMOVE = EXTENSION_ID_POWERSHELL + 3
COMMAND_ID_POWERSHELL_SHELL = EXTENSION_ID_POWERSHELL + 4

################################################
# COMMAND_ID - PRIV
################################################

# ID for the extension (needs to be a multiple of 1000)
EXTENSION_ID_PRIV = 2000

# Associated command ids
COMMAND_ID_PRIV_ELEVATE_GETSYSTEM = EXTENSION_ID_PRIV + 1
COMMAND_ID_PRIV_FS_BLANK_DIRECTORY_MACE = EXTENSION_ID_PRIV + 2
COMMAND_ID_PRIV_FS_BLANK_FILE_MACE = EXTENSION_ID_PRIV + 3
COMMAND_ID_PRIV_FS_GET_FILE_MACE = EXTENSION_ID_PRIV + 4
COMMAND_ID_PRIV_FS_SET_FILE_MACE = EXTENSION_ID_PRIV + 5
COMMAND_ID_PRIV_FS_SET_FILE_MACE_FROM_FILE = EXTENSION_ID_PRIV + 6
COMMAND_ID_PRIV_PASSWD_GET_SAM_HASHES = EXTENSION_ID_PRIV + 7

################################################
# COMMAND_ID - PYTHON
################################################

# ID for the extension (needs to be a multiple of 1000)
EXTENSION_ID_PYTHON = 13000

# Associated command ids
COMMAND_ID_PYTHON_EXECUTE = EXTENSION_ID_PYTHON + 1
COMMAND_ID_PYTHON_RESET = EXTENSION_ID_PYTHON + 2

################################################
# COMMAND_ID - SNIFFER
################################################

# ID for the extension (needs to be a multiple of 1000)
EXTENSION_ID_SNIFFER = 4000

# Associated command ids
COMMAND_ID_SNIFFER_CAPTURE_DUMP = EXTENSION_ID_SNIFFER + 1
COMMAND_ID_SNIFFER_CAPTURE_DUMP_READ = EXTENSION_ID_SNIFFER + 2
COMMAND_ID_SNIFFER_CAPTURE_RELEASE = EXTENSION_ID_SNIFFER + 3
COMMAND_ID_SNIFFER_CAPTURE_START = EXTENSION_ID_SNIFFER + 4
COMMAND_ID_SNIFFER_CAPTURE_STATS = EXTENSION_ID_SNIFFER + 5
COMMAND_ID_SNIFFER_CAPTURE_STOP = EXTENSION_ID_SNIFFER + 6
COMMAND_ID_SNIFFER_INTERFACES = EXTENSION_ID_SNIFFER + 7

################################################
# COMMAND_ID - STDAPI
################################################

# ID for the extension (needs to be a multiple of 1000)
EXTENSION_ID_STDAPI = 1000

# Associated command ids
COMMAND_ID_STDAPI_FS_CHDIR = EXTENSION_ID_STDAPI + 1
COMMAND_ID_STDAPI_FS_CHMOD = EXTENSION_ID_STDAPI + 2
COMMAND_ID_STDAPI_FS_DELETE_DIR = EXTENSION_ID_STDAPI + 3
COMMAND_ID_STDAPI_FS_DELETE_FILE = EXTENSION_ID_STDAPI + 4
COMMAND_ID_STDAPI_FS_FILE_COPY = EXTENSION_ID_STDAPI + 5
COMMAND_ID_STDAPI_FS_FILE_EXPAND_PATH = EXTENSION_ID_STDAPI + 6
COMMAND_ID_STDAPI_FS_FILE_MOVE = EXTENSION_ID_STDAPI + 7
COMMAND_ID_STDAPI_FS_GETWD = EXTENSION_ID_STDAPI + 8
COMMAND_ID_STDAPI_FS_LS = EXTENSION_ID_STDAPI + 9
COMMAND_ID_STDAPI_FS_MD5 = EXTENSION_ID_STDAPI + 10
COMMAND_ID_STDAPI_FS_MKDIR = EXTENSION_ID_STDAPI + 11
COMMAND_ID_STDAPI_FS_MOUNT_SHOW = EXTENSION_ID_STDAPI + 12
COMMAND_ID_STDAPI_FS_SEARCH = EXTENSION_ID_STDAPI + 13
COMMAND_ID_STDAPI_FS_SEPARATOR = EXTENSION_ID_STDAPI + 14
COMMAND_ID_STDAPI_FS_SHA1 = EXTENSION_ID_STDAPI + 15
COMMAND_ID_STDAPI_FS_STAT = EXTENSION_ID_STDAPI + 16
COMMAND_ID_STDAPI_NET_CONFIG_ADD_ROUTE = EXTENSION_ID_STDAPI + 17
COMMAND_ID_STDAPI_NET_CONFIG_GET_ARP_TABLE = EXTENSION_ID_STDAPI + 18
COMMAND_ID_STDAPI_NET_CONFIG_GET_INTERFACES = EXTENSION_ID_STDAPI + 19
COMMAND_ID_STDAPI_NET_CONFIG_GET_NETSTAT = EXTENSION_ID_STDAPI + 20
COMMAND_ID_STDAPI_NET_CONFIG_GET_PROXY = EXTENSION_ID_STDAPI + 21
COMMAND_ID_STDAPI_NET_CONFIG_GET_ROUTES = EXTENSION_ID_STDAPI + 22
COMMAND_ID_STDAPI_NET_CONFIG_REMOVE_ROUTE = EXTENSION_ID_STDAPI + 23
COMMAND_ID_STDAPI_NET_RESOLVE_HOST = EXTENSION_ID_STDAPI + 24
COMMAND_ID_STDAPI_NET_RESOLVE_HOSTS = EXTENSION_ID_STDAPI + 25
COMMAND_ID_STDAPI_NET_SOCKET_TCP_SHUTDOWN = EXTENSION_ID_STDAPI + 26
COMMAND_ID_STDAPI_NET_TCP_CHANNEL_OPEN = EXTENSION_ID_STDAPI + 27
COMMAND_ID_STDAPI_RAILGUN_API = EXTENSION_ID_STDAPI + 28
COMMAND_ID_STDAPI_RAILGUN_API_MULTI = EXTENSION_ID_STDAPI + 29
COMMAND_ID_STDAPI_RAILGUN_MEMREAD = EXTENSION_ID_STDAPI + 30
COMMAND_ID_STDAPI_RAILGUN_MEMWRITE = EXTENSION_ID_STDAPI + 31
COMMAND_ID_STDAPI_REGISTRY_CHECK_KEY_EXISTS = EXTENSION_ID_STDAPI + 32
COMMAND_ID_STDAPI_REGISTRY_CLOSE_KEY = EXTENSION_ID_STDAPI + 33
COMMAND_ID_STDAPI_REGISTRY_CREATE_KEY = EXTENSION_ID_STDAPI + 34
COMMAND_ID_STDAPI_REGISTRY_DELETE_KEY = EXTENSION_ID_STDAPI + 35
COMMAND_ID_STDAPI_REGISTRY_DELETE_VALUE = EXTENSION_ID_STDAPI + 36
COMMAND_ID_STDAPI_REGISTRY_ENUM_KEY = EXTENSION_ID_STDAPI + 37
COMMAND_ID_STDAPI_REGISTRY_ENUM_KEY_DIRECT = EXTENSION_ID_STDAPI + 38
COMMAND_ID_STDAPI_REGISTRY_ENUM_VALUE = EXTENSION_ID_STDAPI + 39
COMMAND_ID_STDAPI_REGISTRY_ENUM_VALUE_DIRECT = EXTENSION_ID_STDAPI + 40
COMMAND_ID_STDAPI_REGISTRY_LOAD_KEY = EXTENSION_ID_STDAPI + 41
COMMAND_ID_STDAPI_REGISTRY_OPEN_KEY = EXTENSION_ID_STDAPI + 42
COMMAND_ID_STDAPI_REGISTRY_OPEN_REMOTE_KEY = EXTENSION_ID_STDAPI + 43
COMMAND_ID_STDAPI_REGISTRY_QUERY_CLASS = EXTENSION_ID_STDAPI + 44
COMMAND_ID_STDAPI_REGISTRY_QUERY_VALUE = EXTENSION_ID_STDAPI + 45
COMMAND_ID_STDAPI_REGISTRY_QUERY_VALUE_DIRECT = EXTENSION_ID_STDAPI + 46
COMMAND_ID_STDAPI_REGISTRY_SET_VALUE = EXTENSION_ID_STDAPI + 47
COMMAND_ID_STDAPI_REGISTRY_SET_VALUE_DIRECT = EXTENSION_ID_STDAPI + 48
COMMAND_ID_STDAPI_REGISTRY_UNLOAD_KEY = EXTENSION_ID_STDAPI + 49
COMMAND_ID_STDAPI_SYS_CONFIG_DRIVER_LIST = EXTENSION_ID_STDAPI + 50
COMMAND_ID_STDAPI_SYS_CONFIG_DROP_TOKEN = EXTENSION_ID_STDAPI + 51
COMMAND_ID_STDAPI_SYS_CONFIG_GETENV = EXTENSION_ID_STDAPI + 52
COMMAND_ID_STDAPI_SYS_CONFIG_GETPRIVS = EXTENSION_ID_STDAPI + 53
COMMAND_ID_STDAPI_SYS_CONFIG_GETSID = EXTENSION_ID_STDAPI + 54
COMMAND_ID_STDAPI_SYS_CONFIG_GETUID = EXTENSION_ID_STDAPI + 55
COMMAND_ID_STDAPI_SYS_CONFIG_LOCALTIME = EXTENSION_ID_STDAPI + 56
COMMAND_ID_STDAPI_SYS_CONFIG_REV2SELF = EXTENSION_ID_STDAPI + 57
COMMAND_ID_STDAPI_SYS_CONFIG_STEAL_TOKEN = EXTENSION_ID_STDAPI + 58
COMMAND_ID_STDAPI_SYS_CONFIG_SYSINFO = EXTENSION_ID_STDAPI + 59
COMMAND_ID_STDAPI_SYS_EVENTLOG_CLEAR = EXTENSION_ID_STDAPI + 60
COMMAND_ID_STDAPI_SYS_EVENTLOG_CLOSE = EXTENSION_ID_STDAPI + 61
COMMAND_ID_STDAPI_SYS_EVENTLOG_NUMRECORDS = EXTENSION_ID_STDAPI + 62
COMMAND_ID_STDAPI_SYS_EVENTLOG_OLDEST = EXTENSION_ID_STDAPI + 63
COMMAND_ID_STDAPI_SYS_EVENTLOG_OPEN = EXTENSION_ID_STDAPI + 64
COMMAND_ID_STDAPI_SYS_EVENTLOG_READ = EXTENSION_ID_STDAPI + 65
COMMAND_ID_STDAPI_SYS_POWER_EXITWINDOWS = EXTENSION_ID_STDAPI + 66
COMMAND_ID_STDAPI_SYS_PROCESS_ATTACH = EXTENSION_ID_STDAPI + 67
COMMAND_ID_STDAPI_SYS_PROCESS_CLOSE = EXTENSION_ID_STDAPI + 68
COMMAND_ID_STDAPI_SYS_PROCESS_EXECUTE = EXTENSION_ID_STDAPI + 69
COMMAND_ID_STDAPI_SYS_PROCESS_GET_INFO = EXTENSION_ID_STDAPI + 70
COMMAND_ID_STDAPI_SYS_PROCESS_GET_PROCESSES = EXTENSION_ID_STDAPI + 71
COMMAND_ID_STDAPI_SYS_PROCESS_GETPID = EXTENSION_ID_STDAPI + 72
COMMAND_ID_STDAPI_SYS_PROCESS_IMAGE_GET_IMAGES = EXTENSION_ID_STDAPI + 73
COMMAND_ID_STDAPI_SYS_PROCESS_IMAGE_GET_PROC_ADDRESS = EXTENSION_ID_STDAPI + 74
COMMAND_ID_STDAPI_SYS_PROCESS_IMAGE_LOAD = EXTENSION_ID_STDAPI + 75
COMMAND_ID_STDAPI_SYS_PROCESS_IMAGE_UNLOAD = EXTENSION_ID_STDAPI + 76
COMMAND_ID_STDAPI_SYS_PROCESS_KILL = EXTENSION_ID_STDAPI + 77
COMMAND_ID_STDAPI_SYS_PROCESS_MEMORY_ALLOCATE = EXTENSION_ID_STDAPI + 78
COMMAND_ID_STDAPI_SYS_PROCESS_MEMORY_FREE = EXTENSION_ID_STDAPI + 79
COMMAND_ID_STDAPI_SYS_PROCESS_MEMORY_LOCK = EXTENSION_ID_STDAPI + 80
COMMAND_ID_STDAPI_SYS_PROCESS_MEMORY_PROTECT = EXTENSION_ID_STDAPI + 81
COMMAND_ID_STDAPI_SYS_PROCESS_MEMORY_QUERY = EXTENSION_ID_STDAPI + 82
COMMAND_ID_STDAPI_SYS_PROCESS_MEMORY_READ = EXTENSION_ID_STDAPI + 83
COMMAND_ID_STDAPI_SYS_PROCESS_MEMORY_UNLOCK = EXTENSION_ID_STDAPI + 84
COMMAND_ID_STDAPI_SYS_PROCESS_MEMORY_WRITE = EXTENSION_ID_STDAPI + 85
COMMAND_ID_STDAPI_SYS_PROCESS_THREAD_CLOSE = EXTENSION_ID_STDAPI + 86
COMMAND_ID_STDAPI_SYS_PROCESS_THREAD_CREATE = EXTENSION_ID_STDAPI + 87
COMMAND_ID_STDAPI_SYS_PROCESS_THREAD_GET_THREADS = EXTENSION_ID_STDAPI + 88
COMMAND_ID_STDAPI_SYS_PROCESS_THREAD_OPEN = EXTENSION_ID_STDAPI + 89
COMMAND_ID_STDAPI_SYS_PROCESS_THREAD_QUERY_REGS = EXTENSION_ID_STDAPI + 90
COMMAND_ID_STDAPI_SYS_PROCESS_THREAD_RESUME = EXTENSION_ID_STDAPI + 91
COMMAND_ID_STDAPI_SYS_PROCESS_THREAD_SET_REGS = EXTENSION_ID_STDAPI + 92
COMMAND_ID_STDAPI_SYS_PROCESS_THREAD_SUSPEND = EXTENSION_ID_STDAPI + 93
COMMAND_ID_STDAPI_SYS_PROCESS_THREAD_TERMINATE = EXTENSION_ID_STDAPI + 94
COMMAND_ID_STDAPI_SYS_PROCESS_WAIT = EXTENSION_ID_STDAPI + 95
COMMAND_ID_STDAPI_UI_DESKTOP_ENUM = EXTENSION_ID_STDAPI + 96
COMMAND_ID_STDAPI_UI_DESKTOP_GET = EXTENSION_ID_STDAPI + 97
COMMAND_ID_STDAPI_UI_DESKTOP_SCREENSHOT = EXTENSION_ID_STDAPI + 98
COMMAND_ID_STDAPI_UI_DESKTOP_SET = EXTENSION_ID_STDAPI + 99
COMMAND_ID_STDAPI_UI_ENABLE_KEYBOARD = EXTENSION_ID_STDAPI + 100
COMMAND_ID_STDAPI_UI_ENABLE_MOUSE = EXTENSION_ID_STDAPI + 101
COMMAND_ID_STDAPI_UI_GET_IDLE_TIME = EXTENSION_ID_STDAPI + 102
COMMAND_ID_STDAPI_UI_GET_KEYS_UTF8 = EXTENSION_ID_STDAPI + 103
COMMAND_ID_STDAPI_UI_SEND_KEYEVENT = EXTENSION_ID_STDAPI + 104
COMMAND_ID_STDAPI_UI_SEND_KEYS = EXTENSION_ID_STDAPI + 105
COMMAND_ID_STDAPI_UI_SEND_MOUSE = EXTENSION_ID_STDAPI + 106
COMMAND_ID_STDAPI_UI_START_KEYSCAN = EXTENSION_ID_STDAPI + 107
COMMAND_ID_STDAPI_UI_STOP_KEYSCAN = EXTENSION_ID_STDAPI + 108
COMMAND_ID_STDAPI_UI_UNLOCK_DESKTOP = EXTENSION_ID_STDAPI + 109
COMMAND_ID_STDAPI_WEBCAM_AUDIO_RECORD = EXTENSION_ID_STDAPI + 110
COMMAND_ID_STDAPI_WEBCAM_GET_FRAME = EXTENSION_ID_STDAPI + 111
COMMAND_ID_STDAPI_WEBCAM_LIST = EXTENSION_ID_STDAPI + 112
COMMAND_ID_STDAPI_WEBCAM_START = EXTENSION_ID_STDAPI + 113
COMMAND_ID_STDAPI_WEBCAM_STOP = EXTENSION_ID_STDAPI + 114
COMMAND_ID_STDAPI_AUDIO_MIC_START = EXTENSION_ID_STDAPI + 115
COMMAND_ID_STDAPI_AUDIO_MIC_STOP = EXTENSION_ID_STDAPI + 116
COMMAND_ID_STDAPI_AUDIO_MIC_LIST = EXTENSION_ID_STDAPI + 117

################################################
# COMMAND_ID - UNHOOK
################################################

# ID for the extension (needs to be a multiple of 1000)
EXTENSION_ID_UNHOOK = 10000

# Associated command ids
COMMAND_ID_UNHOOK_PE = EXTENSION_ID_UNHOOK + 1

################################################
# COMMAND_ID - WINPMEM
################################################

# ID for the extension (needs to be a multiple of 1000)
EXTENSION_ID_WINPMEM = 7000

# Associated command ids
COMMAND_ID_WINPMEM_DUMP_RAM = EXTENSION_ID_WINPMEM + 1

################################################
# TLV Specific Types
################################################
TLV_TYPE_ANY = TLV_META_TYPE_NONE | 0
TLV_TYPE_COMMAND_ID = TLV_META_TYPE_UINT | 1
TLV_TYPE_REQUEST_ID = TLV_META_TYPE_STRING | 2
TLV_TYPE_EXCEPTION = TLV_META_TYPE_GROUP | 3
TLV_TYPE_RESULT = TLV_META_TYPE_UINT | 4

TLV_TYPE_STRING = TLV_META_TYPE_STRING | 10
TLV_TYPE_UINT = TLV_META_TYPE_UINT | 11
TLV_TYPE_BOOL = TLV_META_TYPE_BOOL | 12

TLV_TYPE_LENGTH = TLV_META_TYPE_UINT | 25
TLV_TYPE_DATA = TLV_META_TYPE_RAW | 26
TLV_TYPE_FLAGS = TLV_META_TYPE_UINT | 27

TLV_TYPE_CHANNEL_ID = TLV_META_TYPE_UINT | 50
TLV_TYPE_CHANNEL_TYPE = TLV_META_TYPE_STRING | 51
TLV_TYPE_CHANNEL_DATA = TLV_META_TYPE_RAW | 52
TLV_TYPE_CHANNEL_DATA_GROUP = TLV_META_TYPE_GROUP | 53
TLV_TYPE_CHANNEL_CLASS = TLV_META_TYPE_UINT | 54
TLV_TYPE_CHANNEL_PARENTID = TLV_META_TYPE_UINT | 55

TLV_TYPE_SEEK_WHENCE = TLV_META_TYPE_UINT | 70
TLV_TYPE_SEEK_OFFSET = TLV_META_TYPE_UINT | 71
TLV_TYPE_SEEK_POS = TLV_META_TYPE_UINT | 72

TLV_TYPE_EXCEPTION_CODE = TLV_META_TYPE_UINT | 300
TLV_TYPE_EXCEPTION_STRING = TLV_META_TYPE_STRING | 301

TLV_TYPE_LIBRARY_PATH = TLV_META_TYPE_STRING | 400
TLV_TYPE_TARGET_PATH = TLV_META_TYPE_STRING | 401
TLV_TYPE_MIGRATE_PID = TLV_META_TYPE_UINT | 402
TLV_TYPE_MIGRATE_PAYLOAD = TLV_META_TYPE_RAW | 404
TLV_TYPE_MIGRATE_ARCH = TLV_META_TYPE_UINT | 405
TLV_TYPE_MIGRATE_BASE_ADDR = TLV_META_TYPE_UINT | 407
TLV_TYPE_MIGRATE_ENTRY_POINT = TLV_META_TYPE_UINT | 408
TLV_TYPE_MIGRATE_SOCKET_PATH = TLV_META_TYPE_STRING | 409
TLV_TYPE_MIGRATE_STUB = TLV_META_TYPE_RAW | 411
TLV_TYPE_LIB_LOADER_NAME = TLV_META_TYPE_STRING | 412
TLV_TYPE_LIB_LOADER_ORDINAL = TLV_META_TYPE_UINT | 413

TLV_TYPE_TRANS_TYPE = TLV_META_TYPE_UINT | 430
TLV_TYPE_TRANS_URL = TLV_META_TYPE_STRING | 431
TLV_TYPE_TRANS_UA = TLV_META_TYPE_STRING | 432
TLV_TYPE_TRANS_COMM_TIMEOUT = TLV_META_TYPE_UINT | 433
TLV_TYPE_TRANS_SESSION_EXP = TLV_META_TYPE_UINT | 434
TLV_TYPE_TRANS_CERT_HASH = TLV_META_TYPE_RAW | 435
TLV_TYPE_TRANS_PROXY_HOST = TLV_META_TYPE_STRING | 436
TLV_TYPE_TRANS_PROXY_USER = TLV_META_TYPE_STRING | 437
TLV_TYPE_TRANS_PROXY_PASS = TLV_META_TYPE_STRING | 438
TLV_TYPE_TRANS_RETRY_TOTAL = TLV_META_TYPE_UINT | 439
TLV_TYPE_TRANS_RETRY_WAIT = TLV_META_TYPE_UINT | 440
TLV_TYPE_TRANS_HEADERS = TLV_META_TYPE_STRING | 441
TLV_TYPE_TRANS_GROUP = TLV_META_TYPE_GROUP | 442

TLV_TYPE_MACHINE_ID = TLV_META_TYPE_STRING | 460
TLV_TYPE_UUID = TLV_META_TYPE_RAW | 461
TLV_TYPE_SESSION_GUID = TLV_META_TYPE_RAW | 462

TLV_TYPE_RSA_PUB_KEY = TLV_META_TYPE_RAW | 550
TLV_TYPE_SYM_KEY_TYPE = TLV_META_TYPE_UINT | 551
TLV_TYPE_SYM_KEY = TLV_META_TYPE_RAW | 552
TLV_TYPE_ENC_SYM_KEY = TLV_META_TYPE_RAW | 553
